A security weakness in the Ministry of Transportation's identification system allowed access to the personal information of students from haredi yeshivas all over Israel through the ministry's telephone answering service and website.
Complaints received by the Authority for the Protection of Privacy testified that staff members at haredi yeshivas took advantage of the weakness of the identification system to find out which students had a driver's license. Students with a driver's license were expelled from yeshiva.
To find out whether a student holds a driver's license, one needs to contact the hotline of the Ministry of Transportation or use the website and select the option to get a copy of a license.
The applicant has to enter an ID number and date of birth, details that every student submits during registration, allowing anyone with those details to check if the individual in question has a license.
From the inspection procedure carried out by the Authority, it emerged that the Ministry of Transportation's computerized systems did not use sufficient identification safeguards to verify a person's identity.
In the violation letter that the Authority for the Protection of Privacy sent last month to the Ministry of Transportation, it states that information that a person holds a driver's license is information protected under the Privacy Protection Law, and constitutes at the very least "information about a person's private affairs."
In the violation letter, the Authority stated that the Ministry of Transportation violated its duty as a public body not to provide information about a person from a public database to someone who is not the subject of the information and without the consent of the subject of the information. The Authority also determined that the existing identification system in the Ministry of Transportation's computer systems does not comply with the provisions of the law and regulations. In doing so, the Ministry of Transportation violates its duty to adequately protect the public's information.
In the letter, the Authority emphasizes that "handing over this type of information to an anonymous individual, without the consent of the subject of the information, constitutes a distinct violation of privacy, all the more so where it manifests itself in a substantial harm during the life of the subject of the information, by way of removing him from the yeshiva where he studies, wth all that is implied by that".